Hacker News Reader

Comment by mgaunard | Hacker News Reader

I remember when I was a teenager I found a huge security flaw in a website: they allowed to include any PHP file passed as a query string parameter, and that file could be a remote one too.

They didn't listen to me and I found that offensive, so I used the flaw to get access, and leave a message on their FTP server. I didn't destroy nor steal any data. They responded by reporting the incident to the police.

View on HN

It's the danger of good intents but still breaking the law. If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. Report and move on.

> If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in.

What jurisdiction? I would think this was just trespass.

IIRC some jurisdictions consider any force at all - such as pushing an already-open door further open - to be sufficient to make it B&E rather than simply trespassing.

Force isn’t even required in some places, apparently!

This page expands on the differences in a few countries: https://en.m.wikipedia.org/wiki/Burglary

Canada

> Breaking and entering is defined as breaking into a place with intent to commit another indictable offence

England & Wales

> A person is guilty of burglary if they enter any building or part of a building as a trespasser with intent to steal, inflict grievous bodily harm or do unlawful damage to the building or anything in it.

New Zealand

> burglary is a statute offence under section 231 of the Crimes Act 1961. Originally this was a codification of the common law offence, though from October 2004 the break element was removed from the definition and entry into the building (or ship), or a part of it, now only needed to be unauthorised.

It seems that in many places intent to commit another crime is a key.

But trespassing is (presumably in those jurisdictions) a crime.

Trespassing is ignoring (sufficient) signs posted saying no trespassing, or refusing to leave when a person authorised to demand you leave asks it.

Something like that, I'm not a lawyer.

I can understand land, but isn't entering an actual building/home/garage without permission a crime even if it was unlocked? it seems like it should be, but my view is tainted by US law which is overly complicated and varies state to state about severity, but I'm pretty sure it's against the law in every state.

AFAIK, trespassing per-se is usually not a crime in England. It is typically considered civil matter. It gets more complicated I think if you get told to leave and resist. And of course trespassing with intent to steal is a crime.

IANAL, just a random r/LegalAdviceUK lurker.

yeah, usually you get a forceful entry charge in addition. You can't just walk into someone's house even if their door is ajar or unlocked. I'm not sure if cracking it and say asking "is anyone here?", My guess it involves actually stepping into the house, for example you're worried about a neighbor if his door is standing open

Stepping on someone's land marked as "no trespassing" is one thing (and a big thing) in the USA, just walking into someone's house, is B&E if the person wants the yokels to press charges and you didn't have permission. I assume the same is true for cybercrime, especially if you're using the system in a way it wasn't meant to be, especially if it causes damage of some sort.

No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.

Oh yes. In 2011 I got raided by the police because I clicked a link someone sent me over IRC [1].

You don't even need to be destructive to become a target for prosecution sometimes. Being stupid or incautious is enough.

[1] https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...

I vaguely recall this case. I sure hope police have become more cyber literate in the past 10 years, but yeah this is the virtual equivalent of leaving fingerprints on the crime scene.

After reading your story, the image at the bottom stands out. I never thought about the fact that you can’t really trust that what is returned to you is the same as what they took. No telling if they added any malware to those drives intentionally or not.

> Don't click on links from random people on the internet!

Ironic since I ended up on your blog after clicking on link you posted

Is there no way to contest such a warrant? What about compensation for the loss of utility caused by the confiscation?

Threat of prosecution can come even without breaking in. Vengeful and ignorant people will always be a thing. [1]

Missouri's governor threatened legal action against a reporter who found SSN were being leaked on a public web page accessible simply by clicking "View Source". The reporter "followed standard protocols for disclosing and reporting on the vulnerability, the governor is treating him as if he attacked the site or was trying to access the teacher’s private information for nefarious purposes" .

This pisses me off on so many different levels. The reporter told proper authorities and gave them time to fix it before he made the information public but MO's jack-wagon of a governor tried to pin blame on the reporter.

[1] https://www.theverge.com/2021/10/14/22726866/missouri-govern...

Threat of prosecution is of course always present, but the chance of that prosecution making it past the courts is significantly altered by actually committing the acts you might be accused of.

That should have been a carer ending move. According to wikipedia that jackass Mike Parson can't run again and will be replaced (https://en.wikipedia.org/wiki/2024_Missouri_gubernatorial_el...).

I don't have much faith in Missouri to do better with their next election, but I'd be thrilled to be surprised.

Valuable lesson for a teenager to discover how people really are. I hope the police was more reasonable!

The police allowed them to contact my ISP to get my name and location, not that I was hiding or anything.

Apart from that they just logged the incident and there was no follow-up.

A good lesson to never do that - just use VPN to login to IRC to some hacking channel and report the issue there.

Of course you should also do the white hat part in anonymized fashion.

This is the correct way to handle it. Publish the exploit after you've gave them the warning, but don't execute it yourself.

Nice welcome to the grey hat experience.

Reply on news.ycombinator.com